security: fix return of void-valued expressions